The 2026 standards landscape

OWASP LLM and Agentic Top 10s, ATLAS, NIST, CSA, AIVSS as working tools rather than reading.

◆ Cross-mapping explorer

Standards modules are where courses go to die, so this one has a narrow job. You can look up the ten items. What you need is fluency in which document answers which question, plus the one methodological change in the 2026 edition worth your attention.

Start with how the list was built

Every previous edition of the OWASP LLM Top 10 ran on expert judgement: hundreds of practitioners voting on what matters most. The 2026 edition kept that vote and tested it against evidence.


Incidents collected	7,714 from public vulnerability databases and an AI-harm database
Classified with enough detail to sort	6,639
Weighting	Community vote 75% · incident data 25%

OWASP Top 10 for LLM Applications 2026, letter from the project leads.

The leads are candid about why the vote keeps three-quarters of the weight. One noisy year of data does not get to overturn the judgement of the people doing the work. A quarter is enough to move an entry a tier when belief and evidence diverge sharply, and not enough to let imperfect data rewrite the list.

The useful part is where the two disagreed.

Prompt injection: the defense effect

Practitioners rank prompt injection first. Rank the categories by raw incident count and it falls out of the top ten entirely. OWASP kept it at #1, and the reasoning will recur every time you read a security statistic:

That gap is a defense effect. Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off.

OWASP Top 10 for LLM Applications 2026 · letter from the project leads

A low incident count can mean the problem is rare, or that it is being actively contained at cost. Those demand opposite responses, and the count alone cannot tell you which you are looking at.

Misinformation: the gap that runs the other way

The mirror case, and the one OWASP asks readers to slow down on. Voters placed Misinformation near the bottom. The incident record placed it near the top, the widest gap on the list, in the direction that hurts. It sits at #7 as a compromise, with the vote holding it off the top.

It matters more in 2026 than in 2024 because of agency: when a model's fluent, confident output drives a decision or a tool call, a wrong answer turns into a wrong action. Hallucination becomes a security problem the moment it is wired to something that acts.

The two lists, and how they connect

LLM Top 10 2026 ↔ Agentic Top 10 · select a risk

LLM03:2026Excessive Agency

#6 → #3▲ escalated

Climbed three places, OWASP calls it the most consequential move on the list, because vote and record agree that agentic deployments are where the damage lands.

Maps to 7 agentic entries

ASI01Agent Goal Hijack
ASI02Tool Misuse & Exploitation
ASI03Identity & Privilege Abuse
ASI05Unexpected Code Execution
ASI07Insecure Inter-Agent Communication
ASI08Cascading Failures
ASI09Human-Agent Trust Exploitation

This entry fans out across most of the agentic list. That breadth is the mechanical reason the project leads tell you to read both documents rather than choosing one.

Crosswalk and rank movements transcribed from Appendix A and the project-leads' letter, OWASP Top 10 for LLM Applications 2026 (v2026, 4 Aug 2026).

The fan-out is the point. Prompt injection maps to seven of the ten agentic entries, and Excessive Agency to seven as well. Read only the LLM list for an agentic system and you have read the entry point while skipping the consequences.

Partial control· necessary, not sufficient

Frameworks are for scoping, prioritising and reporting. They are not where you learn to attack anything, and a system that maps cleanly to all twenty entries can still be trivially exploitable. Use them to check you have not forgotten a category, then go and test.

Which document answers which question

Versions are as published in Appendix A of the LLM Top 10 2026, which pins what “current” meant on 4 August 2026:

Document	Version	Reach for it when
OWASP Top 10 for LLM Applications	2026 (4 Aug 2026)	The model is a component in the app.
OWASP Top 10 for Agentic Applications (ASI)	2026 (announced 2025-12-09)	The model has tools, memory, or downstream consequences.
OWASP GenAI Data Security (DSGAI)	v1.0 (2026-03-17)	You need data-layer controls: classification, retention, RAG and embedding handling.
OWASP AIVSS	v0.8	You need to score a finding's severity with agentic factors CVSS cannot express.
MITRE ATLAS	content v2026.06	You need adversary technique IDs for a report. The ATT&CK analogue for AI.
MITRE ATT&CK	v19.1	The agent has become a foothold and you are mapping post-compromise behaviour.
MITRE CWE	4.20	You are writing up a weakness at CVE quality.
NIST AI 600-1 (GenAI Profile)	v1.0 (July 2024)	You need the generative-AI profile of the AI Risk Management Framework.
NIST AI RMF (AI 100-1)	v1.0 (2023)	You need the governance backbone: Govern, Map, Measure, Manage.
CSA AI Controls Matrix (AICM)	v1.1 (2026-06-22)	You are mapping to enterprise audit expectations.

Framework versions per Appendix A, OWASP Top 10 for LLM Applications 2026.

Deep diveReading a standard critically4 min›

Two habits, both of which the 2026 edition rewards.

Notice the hedges. Standards writers choose qualifiers carefully and readers skip them. OWASP says context-window pooling has no enforced trust boundary, not “no boundary.” It calls the Rule of Two a floor, not a bar. It says fine-tuning may reduce disclosure risk while providing no consistent guarantee. Every hedge is doing work, and module 1.1 exists because dropping one produces a confidently wrong mental model.

Notice where a standard admits its own gaps. OWASP recommends the Rule of Two, then in the same sentence tells you it is silent on autonomy depth, citing a vendor blog post whose title is literally an argument against the rule. Guidance that publishes its own counter-argument is more trustworthy, and it tells you where to concentrate your thinking.

The inverse habit matters too. Be suspicious of any AI-security source with no hedges at all. It is either summarising something it has not read, or selling you the gap.

Check yourself

Self-check

1. Prompt injection falls out of the top ten when ranked by raw
   incident count. Why is it still #1, and what is the general lesson
   about incident-count statistics?

2. Which list do you read for an agent with tools and memory, and
   what does the other one still tell you?

3. Why does Misinformation matter more in an agentic system than in
   a chatbot?

4. You need to score the severity of a finding involving an
   autonomous multi-agent workflow. Which document, and why not
   plain CVSS?

Answers

1. The low count is a defense effect: teams fight injection hard, so fewer clean exploits reach public databases. The general lesson is that a low incident count is ambiguous between “rare” and “actively contained at cost,” and those demand opposite responses.

2. The Agentic Top 10 is the primary document. The LLM list still tells you how the model-layer entry point behaves (the injection, the disclosure, the hidden context), which is what usually triggers the agentic failures.

3. Fluent, confident wrong output drives a tool call rather than informing a human. A wrong answer becomes a wrong action, with no reader in between to catch it.

4. AIVSS. Plain CVSS has no vector component for autonomy level, tool-use scope, multi-agent interaction, or non-determinism, and those determine agentic impact. Module 6.9 covers scoring in practice.

Sources